.png?length=1440&upsize=true&upscale=true&name=TH%20blog%20images%20(1).png)
The SEC’s Division of Examinations has published a new Exam Handbook. Much of it is procedural, but three sections stand out as key considerations around what type of tooling and capability a surveillance function needs to have at the ready before an examiner arrives:
The sections below take each point in turn and set out how firms can meet it.
An examiner’s early questions are answered from the surveillance record
The Commission expects records to be available within 24 hours in most circumstances, although the handbook acknowledges that a two-week allowance is typical in practice. Staff also note that the basic questions asked early in an exam are how they learn a business from the firm’s own perspective. For a surveillance function, a basic question is usually about an alert. The examiner wants to know why the alert was raised, how it was dispositioned and who reviewed it. Similarly, an examiner will want to know how surveillance controls have been calibrated and tested.
When answering means restoring archived order book data and assembling the reviewer’s reasoning from free-text notes and email, a 24-hour turnaround can be very challenging. Answers produced under that pressure also tend to be less consistent. Because the early answers shape the examiner’s understanding of the business, inconsistency at that stage is likely to affect the rest of the exam.
The answer is faster when the evidence is held where the surveillance is performed. In MAST (Market Abuse Surveillance Tool), TradingHub’s surveillance platform, an alert, its disposition and its reviewer are held together. Order Book Surveillance (OBS) allows the order book around the alert to be replayed from the alert itself. OBS’s extended lookback means historical activity can typically be reviewed without first unarchiving data. Questions that fall outside a standard report can be handled with CaaS (Calculation as a Service). There, the CaaS Assistant turns a request made in plain English into a custom report run against the data already held in MAST. On testing and calibration, TradingHub’s Model Response Surface (MRS) calibration environment also allows a customer to evidence how a metric was calibrated and tested in the same system the surveillance is being performed on and using the same data. All output from the calibration environment is saved with its full input data grid and a history of past runs, and can be exported as a PDF that includes the configuration used. That gives a repeatable record of the sensitivity testing behind each threshold, ready to hand to an examiner. An examiner’s questions on specific alerts or calibration can then often be answered within the 24-hour expectation, from the same governed data the surveillance itself uses.
Thirty days is seldom enough to build a control in-house
Firms typically have 30 days to respond to a deficiency letter, and the handbook notes that prompt and appropriate corrective action may weigh against referral to Enforcement (which often leads to costly fines and very expensive remediation programmes). In our experience, a new control seldom fits within that window when it is built in-house. It must be specified, sourced with data, built, tested and approved through a bank’s change process. This means the usual response is tactical, often a spreadsheet or an end-user computing control maintained outside the main surveillance system.
Tactical fixes tend to create problems of their own. Surveillance estates at large institutions grew one finding and one regulation at a time, with little governance of the data passing between components. Each tactical control adds another point at which trade and order records can be dropped unnoticed. Some of the largest surveillance-related penalties of recent years have followed exactly this kind of gap in the trading data feeding surveillance. Remediating one finding can therefore create the conditions for the next.
Vendor platforms like MAST are built to meet SEC and other regulatory requirements, but if a bespoke requirement presents itself, a vendor platform changes what can be built in 30 days. TradingHub’s CaaS allows a firm to build controls on the data already held in its trade surveillance system, so the remediation inherits that system’s data governance from the outset. The control also runs in the daily batch and feeds the same case management as every other scenario. Its logic and thresholds are held as readable, versioned script. The CaaS Assistant can turn the written finding into a first draft, which the firm’s own team reviews and approves. The firm can then respond to the letter with an automated, governed control within 30 days. That is the kind of prompt corrective action the handbook suggests may weigh against referral.
The examiner’s silence leaves firms to evidence their own effectiveness
The handbook’s position on deficiency letters matters more for surveillance than for most functions, because surveillance receives little feedback from anywhere else. It sits at the end of the production line. It depends on trade capture, order management, RFQ, market and static data, yet nothing downstream uses its output beyond the case management system. Errors in finance surface as P&L disputes, and errors in risk surface as limit breaches and margin disagreements. A surveillance programme that has silently lost a feed may simply generate fewer alerts. Whether 3 alerts a day reflects good conduct or missing data cannot be determined from the alert count alone. The handbook confirms that the examiner will not provide a blueprint, or best practices, the evaluation of the controls and how it is performed is solely up to each individual surveillance team.
Here a system shared with peers offers something the handbook withholds. A platform used across a group of peer institutions brings scenarios, calibration methods and typology coverage that reflect the requirements and review findings of many firms. A firm running it can show that its surveillance is consistent with the practice of its peers, even where the regulator declines to say what best practice is. That assurance is a baseline. It does not replace the firm’s own evidence. Examiners will still expect the firm to account for the choices it made on top of that baseline. In our view, three kinds of evidence carry most weight:
Model risk faced a similar gap and closed it through a validation discipline, formalised in the US in the Federal Reserve’s SR 11-7 guidance, now superseded by SR 26-2. Surveillance has no equivalent common standard yet, although the evidence above amounts to most of one.
Surveillance validation is already expected, but not yet standardised
Model risk management became a discipline once supervisors recognised that firms were relying on outputs nobody had independently tested. Surveillance has reached the same point. Internal audit functions and examiners already ask firms to show that their surveillance covers the right typologies, is calibrated for reasons the firm can explain and receives complete data. What is missing is a common standard for that evidence, so most firms still assemble it by hand for each review. A firm that produces this evidence as a by-product of running its surveillance could answer a 24-hour records request and a 30-day deficiency letter from the same record. That is how TradingHub designs MAST and CaaS to work. In MAST, an alert, its disposition and its review are held together, the order book can be replayed from the alert, and calibration evidence lives within the same system, so an examiner’s early questions are answered from the surveillance record rather than reconstructed. CaaS lets a firm answer a deficiency letter with an automated, governed control, built on the data it already surveils, within the 30-day window. Coverage mapping, calibration in a common USD unit and data governance give the firm its own evidence of effectiveness. The handbook makes clear that the examiner will not provide that evidence. A firm using MAST can have it ready before the exam begins.
